Summary

Release v4.12.3 (2026-02-26) is a maintenance patch addressing parser, JWT, and TypeScript type issues. It includes fixes to form-data parsing, safer JWT timestamp handling, memory-leak prevention, and removal of unnecessary DOM type dependencies. New contributors: YevheniiKotyrlo and hmnd.

Key Points

• fix(validator): prevent type-diff bug in form data parsing — avoids incorrect type detection when parsing multipart/form or urlencoded forms.
• fix(jwt): use Math.floor instead of bitwise OR for timestamp truncation — ensures safe timestamp handling across environments.
• fix(jwt): prevent memory leak by avoiding mutation of the options object — prevents retaining references.
• fix(jwt): correct JwtVariables typing to align with ContextVariableMap.
• fix(types): remove DOM type dependencies from ClientResponse and request method — improves compatibility with non-DOM runtimes (e.g., edge, Deno).
• fix(types): correct middleware types to resolve signature mismatches.

Upgrade

Update to v4.12.3 to obtain these bug fixes. No breaking changes are expected, but run your TypeScript build/tests after upgrading to catch any typing adjustments.